Subject: Re: Queries about chroot

From: [email-masked] (Geoff Terry Systems & Net supt 064 923677)
Date: Tue, 11 Mar 1997 10:21:44 +1100 (EST)

Janet,
Take a look at the FAQ and try using guest groups (guest accounts get
chroot'd to their home directory)

Regards Geofft
>I have installed wu-ftpd-2.4.2-beta-12 on Solaris2.3.  For the 
>ftp/anonymous ftp, it seems to work okay.  However, for other users, 
>they will be able to change to root directory just by "cd /".  Could 
>somebody please let me know how I will be able restrict the cd access.
>
>Thanks,
>Janet Leung, TACTech, Inc., Yorba Linda, CA 92887
>
>
>
>
Geoff Terry    Systems & Network Support
ACR Net        Sapphire Coast NSW 2550
Australia
Ph 064 923677  Mobile 015 668 227 Fax 064 924594

---

From: [email-masked]
Date: Mon, 10 Mar 1997 16:42:12 -0800 (PST)

I am hoping we might try something else instead in the future.
I wrote a modification in which I check a folder exactly like ftpusers 
except it is groups restricted to their own folder.

Then instead of chroot (which requires a bin directory for every user and 
therefore if you have a lot of users a lot of overhead), i simply check 
in the cwd routine if they are in a restricted group and their cd takes 
them out of their directory path i cwd back to their directory.

Some processing overhead, but i have well over a thousand accounts that 
all have a restricted shell for telnet, and i needed them restricted for ftp.
It does allow them to cd down in their directory, just not out of it.  I 
also do a realpath() so symlinks don't work.

--dale welch
'Net Works

---

From: Rafael Vilarino Kuhn <[email-masked]>
Date: Mon, 02 Dec 1996 14:26:00 -0200

> also do a realpath() so symlinks don't work.

I have interest in your solution. I search a good solution for this a
long time.
How I do know this?

Rafael Vilarino Kuhn
[email-masked]

---

From: Alain Magloire <[email-masked]>
Date: Tue, 11 Mar 1997 13:33:37 -0500 (EST)

Bonjour Mr [email-masked]

> therefore if you have a lot of users a lot of overhead), i simply check 

chroot(), in spite of all the desavantages, provides a layer of security
... a jail.. (or an illusion of jail, if we look at the history of
security holes in ftpd :-)

> i simply check 

I can see a lot of race conditions in this approach, remember
David Greenman advisory ... If I nag the server for ex: with
cd /very/long/pathname, and send a SIGURG(OOB), I'll be out of jail
an do anything I please under "/", or until the next cd.

> all have a restricted shell for telnet, and i needed them restricted for ftp.

why chdir() them back **after**
why not just prepend the restricted_path to path
and let chdir() do the rest. This way it will restrict the flip floping
with chdir().

cwd(char *path)
{
  ....
  /*code to check if they're restricted */
  ...
  snprintf(cdpath, sizeof cdpath, "%s/%s", restricted_root, path)
  if (chdir(cdpath) >= 0) {
    /* send a complaint */
    ....
  }

  ....
}

> also do a realpath() so symlinks don't work.

but how do you cope with the rest of the commands ??

You work so far is on cwd() and you maintain a simile jail
without chrooting. But what about the rest of commands ?

get ../../restricted_file
put ../../restricted_file
or
del ../../../file
or
site exec command ../../../../file

etc ...

Nevertheless the idea of maintaining a 'false jail' (with a few processing
overhead) to not use chroot() is very interesting an woth exploring.
If you code is not restricted, why don't you send it, maybe it will
be usefull to someone.

-- 
au revoir, alain
----
Teamwork is essential -- it allows you to blame someone else.

---

From: [email-masked]
Date: Tue, 11 Mar 1997 14:54:48 -0800 (PST)

I am at internet world this week but next week i will make available my 
code / suggestions for alternate handling instead of chroot.

I obviously need to read the rfc's regarding ftp and see the interactions 
with all of the commands.

My solution is currently a quick fix but perhaps with others knowledge a 
fix for it's pproblems could be attempted.

---dale welch